Bug 30741

Summary:	Does not properly validate UTF-8 received from the network.
Product:	Telepathy	Reporter:	Will Thompson <will>
Component:	idle	Assignee:	Telepathy bugs list <telepathy-bugs>
Status:	RESOLVED FIXED	QA Contact:	Telepathy bugs list <telepathy-bugs>
Severity:	normal
Priority:	medium	Keywords:	patch
Version:	git master
Hardware:	Other
OS:	All
URL:	http://cgit.collabora.com/git/user/wjt/telepathy-idle/commit/?h=invalid-utf8
Whiteboard:	r+
i915 platform:		i915 features:

Description Will Thompson 2010-10-09 16:31:15 UTC

If Idle receives a message containing well-formed UTF-8, it doesn't verify that all the code-points are actually defined. So if you send it the UTF-8 encoding of, say, U+FDD2, it happily puts that into a D-Bus signal and gets booted by dbus-daemon (or maybe by dbus-glib? Unsure).

Thanks to Nicolas Coevoet for reporting this on #telepathy.

Comment 1 Will Thompson 2010-10-09 16:38:09 UTC

Here's a (failing) test case.

The invalid string seems to have just been returned by g_convert() as being valid UTF-8!

Comment 2 Will Thompson 2010-10-09 16:40:00 UTC

IIRC, libpurple has a function that tries to salvage strings that should be UTF-8 but aren't, by replacing unparseable bytes of the string with '?'. Maybe we should do the same, or put something into GLib which does that.

Comment 3 Will Thompson 2012-10-29 08:31:52 UTC

I fixed this bug. Please enjoy the attached patch.

Comment 4 Jonny Lamb 2012-10-29 10:04:04 UTC

Seems fine. It took me a bit to realise this is fine:

+ bytes -= valid_bytes + 1;

I'd probably have added brackets to make it more explicit, but that's just me.

So without this patch running the test makes the daemon push idle off the bus or does it just not signal anything because it doesn't validate?

Comment 5 Will Thompson 2012-10-29 10:19:41 UTC

(In reply to comment #4)
> Seems fine. It took me a bit to realise this is fine:
> 
> + bytes -= valid_bytes + 1;
> 
> I'd probably have added brackets to make it more explicit, but that's just
> me.

I've bracketed both instances of "valid_bytes + 1".

> So without this patch running the test makes the daemon push idle off the
> bus or does it just not signal anything because it doesn't validate?

Idle gets kicked off the bus.

Merged as http://cgit.freedesktop.org/telepathy/telepathy-idle/log/?id=79425a010af79070a6b93c25deb5690cc72daf87 .

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.